Thriving 
HT el-brujo stuff from elhacker.NET - DDos Attacks history and List of updated IP's from detected attacks from WAF CLoudFlare Pro Plan (HTTP Layer 7 and Rate Limit)
https://blog.elhacker.net ↗ HEALTH ? 80 / Healthy
Thriving HT // readme
List of DDoS attacks
Automatically reported banned IPs from fail2ban and CloudFlare WAF from elhacker.NET
Overview
Two lists:
Auto-update WAF CloudFlare blocklist last 24 hours updated every 4 minutes https://github.com/ehnwebmaster/stuff/blob/main/ips_bloqueadas.txt
Auto-update fail2ban blocklist https://github.com/ehnwebmaster/stuff/blob/main/fail2ban-drops.txt
Works with ipset (iptables) — Linux, OPnsense, etc (use drop or reject) or CloudFlare Lists (see examples)
How It Works
Attacker → fail2ban or CloudFlare from WAF detects abuse → updates the two lists every x minutes
- WAF CloudFlare detects events from the firewall CloudFlare using API GraphQL including layer 7 DDoS, Rate Limit and WAF events including custom rules (excluding IP’s from Tor and 10 or more hits and sorted by hits)
- fail2ban detects too much pettitions in short range of time, 404 pettitions, modSecurity rules hits.
The two ban lists
CloudFlare Firewall WAF
https://github.com/ehnwebmaster/stuff/blob/main/ips_bloqueadas.txt
Fail2Ban
https://github.com/ehnwebmaster/stuff/blob/main/fail2ban-drops.txt
##…